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The first name In second chances.™ 

Ecterd 

MEMORANDUM OF UNDERSTANDING 

This Memorandum of Understanding ("MOU") is entered Into on April 1, 2015 by and between 
Eckerd Youth Alternatives, Inc. d/b/a Eckerd ("Eckerd"), a Florida not for profit corporation and the 
Oklahoma Department of Human Services ("OKDHS") with respect to our recent discussions 

regarding Eckerd Rapid Safety Feedback’”. Eckerd and OKDHS are sometimes referred to herein 
collectively as the "Parties," 

Intent. This MOU Identifies the Parties' understandings of their rights and obligations to 
each other with respect to the implementation of Eckerd Rapid Safety Feedback™. 

2. Non-Binding Provisions 
A. Definitions 

1. Agency means the Oklahoma Department of Human Services. 

2. Confidential Information means information each party may come into contact 
with concerning the other party, including without limitation client records and 
other proprietary information which must remain confidential pursuant to the 
terms of this MOU. 

3. Eckerd Rapid Safety Feedback ,M means a program developed by Eckerd that 
utilizes predictive analytics to help identify child welfare cases of the highest 
probability of a serious injury or death and identifying critical case practices, 
that when performed by the Agency to applicable standards, will greatly assist 
in keeping the child safe. 

4. Eckerd Rapid Safety Feedback'» Community of Practice means the Agency 

participating in quarterly fidelity reviews and sharing information and reports 
with Eckerd. 


5. Fidelity Reviews means a review by Eckerd to ensure the Agency is 

implementing Eckerd Rapid Safety Feedback™ according to established 
practices. 

6. SACWIS means the jurisdiction's statewide automated child welfare information 
system. 
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7. Portal means a website and related technology that Is designed to read SACWIS 
Information, perform automated analysis, and generate reports that can be 
used to implement and support Eckerd Rapid Safety Feedback™. 

8. Portal Terms means the website usage terms available on the Portal that sets 
forth the terms and conditions under which the Agency may use the Portal. 


9. QA means Agency Quality Assurance staff member that does not carry a 
caseload. 

B. Introduction 

a. Eckerd is a not for profit corporation that specializes in human services, 
specifically child welfare. During the course of its business, Eckerd has 
developed Eckerd Rapid Safety Feedback™, a program that has been successful 
in reducing the occurrence of serious injury or death in high risk dependency 
cases. 

2. Eckerd, with its affiliates, has developed the Portal and related training 
materials to assist agencies that desire to implement Eckerd Rapid Safety 
Feedback™ 

3. Agency has chosen Eckerd to implement Eckerd Rapid Safety Feedback™ In the 
State of Oklahoma, and this MOU describes the responsibilities of Eckerd and 
the Agency in connection with that implementation. 

C. Eckerd's Responsibilities 

1. Access, Host, maintain and support the Portal with a goal of providing the 

Agency with 24 hour technical support and access to the Portal and the reports 
it generates. 

2. S ample. Adapt the Portal to create reports that provides a customized 
predictive data sample of prioritized cases for review. 

3. iL aj n ing . Provide training on review completion, .portal entry, staffing 
techniques, and action item tracking to support the Agency's implementation of 
Eckerd Rapid Safety Feedback™. 

4. Pra ctice Guide. Provide Agency personnel with access to the Eckerd Rapid Safety 
Feedback™ practice guide for use in connection with the Agency's 
implementation and offer same day technical assistance from case review staff 
experienced in the review process. 

5. R eviews. Perform quarterly fidelity reviews and coordinate sharing of best 
practices across jurisdictions through the Eckerd Rapid Safety Feedback™ 
Community of Practice. 




6. R eports. Provide additional reports as mutually agreed upon by Eckerd and the 
Agency. 

D. Agency's Responsibilities 

1 * i ACWlS. The Agency will allow Eckerd and Mlndshare Consulting Group, LLC and 
its affiliates access to the SACWIS system to extract client-specific data no less 
than at least once per week. The Agency will allow Eckerd access to the SACWIS 
system to view client-specific data no less than at least once per week." 

2. . Pe e r Reviewers. Provide sufficient reviewers to the Eckerd Rapid Safety 
Feedback™ program. Reviewers should be dedicated QA staff that are NOT 
investigating or managing the case or providing supervision to the front line 
workers assigned to the case. Reviewers must successfully complete Eckerd 
Rapid Safety Feedback™ training (provided at no cost to Eckerd) prior to 
completing case reviews. 

3 * Community of Practice. Participate in a quarterly Fidelity Review, sharing 
lessons learned with other jurisdictions, and report the results observed after 
implementation of Eckerd Rapid Safety Feedback™. 

4. Use of Portal. The Agency QA staff member will enter all case reviews into the 
Eckerd Rapid Safety Feedback™ portal to provide automated tracking 
functionality, dashboards, and data for the continuous improvement of existing 
predictive data sets for the Eckerd Rapid Safety Feedback™ Community of 
Practice. 

5. N otice. Provide Eckerd written notice of any lawsuit or claim filed or asserted 

against the Agency alleging liability in connection with Eckerd Rapid Safety 
Feedback™ 1 

3. Binding Provisions 

A. Term of MOU 

1. lerrn. This MOU will begin at 08:00AM E$T on April 1, 2015 and terminate at 
11:59PM EST on March 31, 2016 (the "Term") unless terminated earlier 
pursuant to Section 3A.2., 

2. T ermination. Either party may terminate this MOU for any reason with ten (10) 
calendar day written notice to the other party. 


3. Re new al. There are no renewals to this MOU; however, the Parties may 
negotiate a contract to continue Eckerd Rapid Safety Feedback™ as mutually 
agreed upon. 
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B. Compensation 


1. There will be no monetary compensation paid between the parties during the 
Term of this MOU. Consideration for this agreement shall be the mutual 
covenants and promises set forth herein. 

C. Binding Effect. 

1. All provisions under Section 3 of this MOU will create legally binding obligations 
on the Parties (the "Binding Provisions") and will survive any termination of this 
MOU. Except for the Binding Provisions, this MOU will constitute an expression 
of intent only and is not intended to create any legally binding obligation that is 
enforceable against any Party. 

D. Intellectual Property 

1. All SACWIS data will be deemed and treated as Confidential Information of the 
Agency. All Intellectual property rights In and to the SACWIS data will remain 
the sole property of the Agency. By making SACWIS data available to Eckerd 
and its affiliates, the Agency will grant, and hereby does grant, to Eckerd a 
limited, non-exclusive, royalty-free, fully-paid-up license for the term of this 
MOU to use the SACWIS data, but solely for the purpose of implementing 
Eckerd Rapid Safety Feedback™ for the Agency, providing the Portal and related 
reports, and improving Eckerd Rapid Safety Feedback™. 


2. All intellectual property rights in and to Eckerd Rapid Safety Feedback™, the 
Portal and Its related software and documentation, the reports generated by 
the Portal, the Eckerd Rapid Safety Feedback™ training materials, the Eckerd 
Rapid Safety Feedback™ safety guide (including without limitation for all of the 
foregoing, all related inventions, processes, improvements, trade secrets, 
algorithms, works of authorship, trademarks and service marks) (jointly the 
'Eckerd IP") is and will remain the sole property of Eckerd, its affiliates, and 
their licensors. All Eckerd IP will be deemed and treated as Confidential 
Information of Eckerd. Eckerd wilt grant, and hereby does grant, to the Agency 
a limited, non-exclusive, royalty-free, fully-paid-up license for the term of this 
MOU to use the Eckerd IP, but solely for the purpose of implementing Eckerd 

Rapid Safety Feedback™ for the Agency and subject to this MOU and the Portal 
Terms. 

3. By using the Portal, Agency is agreeing to abide by, and to be bound by, the 
Portal Terms and any applicable laws (including, without limitation laws relating 
to privacy and personal identifying information relating to children). 


E. Information Security 

1. Eckerd will perform an annual audit of information security risk assessment 
that is due to the Agency Office of Inspector General Security & Emergency 
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Management Unit by the first day of November of each year for private entities 
and by the last day of January for public entities. The final information security 
risk assessment report shall identify, prioritize and document information 
security vulnerabilities of Eckerd. Eckerd is granted 60 business days after final 
report submission to respond with a mitigation plan for the identified security 
vulnerabilities. Eckerd shall use either the standard security risk assessment 
created by the Office of Management and Enterprise Services or a third-party 
risk assessment meeting of the ISO/IEC 27002 standards and using the National 
Institute of Standards and Technology Special Publication 800-30 (NIST SP800- 
30) process and approved by the Office of Management and Enterprise Services. 

2. Eckerd will disclose any breach of the security system following discovery or 
notification of the breach in the security of the data to any resident of 
Oklahoma whose encrypted or unencrypted personal information was, or is 
reasonably believed to have been, acquired by an unauthorized person. The 
disclosure shall be made In the most expedient time possible and without 
unreasonable delay to Agency Office of the Inspector General & Emergency 
Management Unit. Eckerd must deliver a final report of the breach post¬ 
mortem, citing the reason, sources, affected records, mitigation plans or actions 
within 10 business days of the breach discovery. 


3. Eckerd will comply with the Federal Information Processing Standards - FIPS 
200 that promotes the development, implementation and operations secure 
information systems within governmental agencies by establishing minimum 
levels of due diligence for information security that meet minimum security 
requirements. Eckerd must sign Agency acceptable use, confidentiality and non¬ 
disclosure agreements; user login authorization; and my subject to background 
checks. 


F. User Logon Authorization 

1. Eckerd will not be granted access to the Agency information systems without 
the prior completion and approval of Form 05SC004E. Logon Authorization 
Request for Non-DHS Employees. Certain types of access may require that a 
background check and verification be performed prior to granting access. 
Eckerd will notify the Agency immediately when employees have access to 
Agency systems are terminated. 

G. Background checks and verification 

1. At the sole discretion of the Agency, Eckerd may be subject to user background 
checks, depending on the information systems Eckerd accesses or types of data 
Agency provides. Eckerd must submit the required background check 
information to the agency in a timely manner. The agency will not process any 
access agreements prior to completion of user background verification. 
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H. Business continuity and disaster recovery 

1. Eckerd will comply with the Office of Enterprise and Management Services 
minimum mandatory standards for Information security and internal controls 
for contingency planning and disaster recovery. Eckerd will develop business 
continuity and disaster recovery plans as stated in the Office of Enterprise and 
Management Service Core Oklahoma Information Security Polity Section 8.0, 
Business Continuity found at 

http://www.ok.R0v/OSF/documents/securltvl210S.pdf . Contractor is further 
required to exercise, not less than annually, the recovery of capabilities of 
developed plans. Contractor must submit exercise summaries annually or as 
exercises are conducted by DHS Office of Inspector General Security & 
Emergency Management Unit. 

I. Auditing and Compliance 

1. Agency Office of Inspector General Security & Emergency Management Unit 
may, at Its discretion, audit Eckerd for information security compliance. 
Eckerd must supply corrective action plans for non-compliant audit findings 
within 30 business days from the receipt of the final audit report from the 
Agency. 

2. Eckerd shall agree to use and disclose Protected Health Information in 
compliance with the Standards for Privacy of Individually identifiable Heaith 
Information ("Privacy Rule") Parts 160,162, and 164 of Chapter 45 of the Code 
of Federal Regulations (45 C.F.R. Parts 160, 162 and 164) under the Health 
Insurance Portability and Accountability Act (HIPAA) of 1996 if the data they 
are hosting, storing, accessing, utilizing, managing or manipulating contain 
electronic Protected Health Information (ePHI). The definitions set forth in 
the Privacy Rule are Incorporated by reference into this contract (45 C.F.R. 
160.103 and 164.501). Documentation of HIPAA compliance, including but 
not limited to, summaries of policies, procedures, practices and user training 
of this standard must be provided to the Agency, Office of Inspector General 
Security & Emergency Management Unit. Failure to comply with the 
requirements of this standard may result In a full audit and inspection of 
Eckerd's HIPAA security compliance as it pertains to this MOU. Eckerd will 
sign and adhere to an Agency Business Associate Agreement (BAA). The 
Business Associate Agreement provides for satisfactory assurances that Eckerd 
will use the Information only for the purposes for which it Is engaged. Eckerd 
agrees it will safeguard the Information from misuse, and will comply with 
HIPAA as it pertains to the duties stated within the contract. Failure to comply 
with the requirements of this standard may result in a full audit and inspection 
of Eckerd's security compliance as it pertains to this contract. 

J. Business Associate Agreement 

1. BACKGROUND AND PURPOSE: The Parties have entered into, or may in the 
future enter into, one or more written agreements that require Business 
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2. 


Associate '° be provided with, to have access to, and/or to create Protected 
Heal h Information (PHI), (the "underlying Contract(s)"), subject to the federal 
regulations Issued pursuant to the Health Insurance Portability and 
Accountability Act (HIPAA) and codified at 45 C.F.R., parts 160 and 164 (HIPAA 
Regulations). This Business Associate Agreement (BAA) shall supplement 
and/or amend each of the Underlying Contract(s) only with respect to the 
Business Associate's Use, Disclosure, and creation of PHI under the Underlying 

unu-f ll0 4 W c ° vered Entlt V t0 “B'P'y with Sections 164.502(c) and 
l 6 4.314(a)(2)(i) of the HIPAA Regulations. Business Associate acknowledges 

tolnht H t0 nTfiI y f h ‘ he HIPM Securlty and Pr,vacy re f> ulat| ons pursuant 
Health a Wmrrrul ? information Technology for Economic and Clinical 

ef anncf? !* 1-^ '™ 6 Xlli ' ° f the American Recovery and Reinvestment Act 
of 2009, Including Sections 164.308, 164.310, 164.312 and 164.316 of title 45 

o he Code of Federal Regulations. Except as so supplemented and/or 

r^n' h ! “ the Under| y |n 6 Contract(s) shall continue unchanged 
,. dS A hal1 a PP ly wlth ful1 force ar >d effect to govern the matters addressed in 
the BAA and in each of the Underlying Contract(s). 

° E . F ' I ! JIT '°^ S ' Unle f otherwise defined in this BAA, all capitalized terms used 
in this BAA have the meanings ascribed In the HIPAA Regulations, provided; 

" eVei ? that PHI and " ePHI " s hall mean Protected Health Information and 
iLrfi™'o Ptotected Health Information, respectively, as defined in 45 C.F.R. § 
160.103, limited to the information Business Associate received from or 

(DHsTl°nHc“n V 1 ° n b6half ° f the ° k,ah ° ma Depart ment of Human Services 
(DHS) as DHS Business Associate. "Administrative Safeguards" shall have the 

S T\!" e ng 35 th ® term '' admln| strative safeguards in 45 C.F.R. § 164.304 
w h the exception that it shall apply to the management of the conduct of 
Business Assochite's workforce, not DHS's workforce, in relation to the 
protection of that information. Covered Entity Is Oklahoma Department of 

Human Sendees ( OKDHS") and Business Associate is Eckerd Youth 
Alternatives, Inc. d/b/a Eckerd ("Eckerd") 

3 ' AS “ C j at f‘ " Business Associate" shall generally have the same meaning 

as the term Business Associate" at 45 C.F.R. 160.103, and In reference to the 
party to this agreement, shall mean the entity whose name appears below. 

4. Covered Entity. "Covered Entity" shall generally have the same meaning as the 
term Covered Entity" at 45 C.F.R. 160.103. 

5. HIPM Rules. "HIPAA Rules" shall mean the Privacy, Security, Breach Notification, 
amended rCement ^ 45 C ' FR ' ^ 16 ° and Part 164 ' al1 as may ba 


6 . 


The following terms used In this Agreement shall have the same meaning as 

Set S nkrln mS m L ,T AA RUl9S: Bre3ch ' Data Aggregation, Designated Record 
Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice 

Pr 'y acy P ; act,ces ' Protected Health Information, required by law. Secretary, 
Security incident, Sub-Contractor, Unsecured PHI, and Use. Obligations of 
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Business Associate: Business Associate may use Electronic PH! and PHI 
(collectively, "PHI") solely to perform Its duties and responsibilities under this 
Agreement and only as provided in this Agreement. Business Associate 
acknowledges and agrees that PHI is confidential and shall not be used or 
disclosed, in whole or in part, except as provided In this Agreement or as 
required by law. Specifically, Business Associate agrees it will: 

a) use or further disclose PHI only as permitted in this Agreement or as Required 
by Law, including, but not limited to the Privacy and Security Rule; 

b) use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 
with respect to Electronic PHI, to prevent use or disclosure of PHI other than as 
provided for by this Agreement; 

c) implement and document appropriate administrative, physical, and technical 
safeguards to protect the confidentiality, integrity, and availability of PHI that it 
creates, receives, maintains, or transmits for or on behalf of Covered Entity in 
accordance with 45 C.F.R. 164; 

d) implement and document administrative safeguards to prevent, detect, 
contain, and correct security violations in accordance with 45 C.F.R. 164; 

e) make its policies and procedures required by the Security Rule available to 
Covered Entity solely for purposes of verifying BA's compliance and the 
Secretary of the Department of Health and Human Services (HHS); 

f) not receive remuneration from a third party in exchange for disclosing PHI 
received from or on behalf of Covered Entity; 

g) in accordance with 45 C.F.R. 164.502(e) (1) and 164.308(b), if applicable, ensure 
that any Sub-Contractors that create, receive, maintain or transmit PHI on 
behalf of the Business Associate agree to the same restrictions, conditions, and 
requirements that apply to the Business Associate with respect to such 
information; this shall be in the form of a written HIPAA Business Associate 
Contract and a fully executed copy will be provided to the Contract Monitor; 

h) report to Covered Entity in writing any use or disclosure of PHI that is not 
permitted under this Agreement as soon as reasonably practicable but in no 
event later than five calendar days from becoming aware of it and mitigate, to 
the extent practicable and in cooperation with Covered Entity, any harmful 
effects known to it of a use or disclosure made in violation of this Agreement; 

I) promptly report to Covered Entity in writing and without unreasonable delay 
and in no case later than five calendar days after becoming aware of any 
Security incident, as defined in the Security Rule, with respect to Electronic PHI; 
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j) with the exception of law enforcement delays that satisfy the requirements of 
45 C.F.R. 164.412, notify Covered Entity promptly, in writing and without 
unreasonable delay and in no case later than five calendar days, upon the 
discovery of a breach of Unsecured PHI. Such notice shall include, to the extent 
possible, the name of each Individual whose Unsecured PHI has been, or is 
reasonably believed by Business Associate to have been, accessed, acquired, or 
disclosed during such Breach. Business Associate shall also, to the extent 
possible, furnish Covered Entity with any other available information that 
Covered Entity is required to include in its notification to Individuals under 45 
C.F.R. § 164.404(c) at the time of Business Associate's notification to Covered 
Entity or promptly thereafter as such information becomes available. As used in 
this Section, "breach" shall have the meaning given such term at 45 C.F.R. 
164.402; 

k) to the extent allowed by law, indemnify and hold Covered Entity harmless from 
all claims, liabilities, to the extent allowed by law, indemnify and hold Covered 
Entity harmless from all claims, liabilities, costs, and damages arising out of or in 
any manner related to the disclosure by Business Associate of any PHI or to the 
breach by Business Associate of any obligation related to PHI; 

l) provide access to PHI in a Designated Record Set to Covered Entity, or if 
directed by Covered Entity to an Individual in order to meet the requirements of 
45 C.F.R. 164.524. In the event that any Individual request access to PHI directly 
from Business Associate, Business Associate shall forward such request to 
Covered Entity within five working days of receiving a request. This shall be in 
the form of a written HIPAA Business Associate Contract and a fully executed 
copy will be provided to the Contract Monitor. Any denials of access to the PHI 
requested shall be the responsibility of Covered Entity; 

m) make PHI available to Covered Entity for amendment and incorporate any 
amendments to PHI in accordance with 45 C.F.R. 164.526; 

n) document disclosure of PHI and information related to such disclosure as would 
be required for Covered Entity to respond to a request by an Individual for an 
accounting of disclosures of PHI, in accordance with 45 C.F.R. 164.528, and 
within five working days of receiving a request from Covered Entity, make such 
disclosure documentation and Information available to Covered Entity, in the 
event the request for an accounting is delivered directly to Business Associate, 
Business Associate shall forward within five working days of receiving a request 
such request to Covered Entity; 

o) make its internal practices, books, and records related to the use and disclosure 
of PHI received from or created or received by Business Associate on behalf of 
Covered Entity available to the Secretary of the Department of HHS, authorized 
governmental officials, and Covered entity for the purpose of determining 
Business Associate's compliance with the Privacy Rule. Business Associate shall 
give Covered Entity advance written notice of requests from HHS or government 



officials and provide Covered Entity with a copy of all documents made 
available; and 


p) ensure that all of its Sub-Contractors, vendors, and agents to whom It provides 
PHI or who create, receive, use, disclose, maintain, or have access to Covered 
Entity's PHI shall agree In writing to requirements, restrictions, and conditions at 
least as stringent as those that apply to Business Associate under this 
Agreement, including but not limited to implementing reasonable and 
appropriate safeguards to protect PHI, and shall ensure that its Sub-Contractors, 
vendors, and agents agree to indemnify and hold harmless Covered Entity for 
their failure to comply with each of the provisions of this Agreement. 


7. Permitted Uses and Disclosures of PHI by Business Associate: Except as otherwise 
provided in this Agreement, Business Associate may use or disclose PHI on behalf of or 
to provide services to Covered Entity for the purposes specified in this Agreement, if 
such use or disclosure of PHI would not violate the Privacy Rule if done by Covered 
Entity. Unless otherwise limited herein, Business Associate may: 

a) use PHI for its proper management and administration or to fulfill any present 
or future legal responsibilities of Business Associate; 

b) disclose PHI for its proper management and administration or to fulfill any 
present or future legal responsibilities of Business Associate, provided that; (i) 
the disclosures required by law; or (ii) Business Associate obtains reasonable 
assurances from any person to whom the PHI is disclosed that such PHI will be 
kept confidential and will be used or further disclosed only as Required by Law 
or for the purpose(s) for which it was disclosed to the person, and the person 
commits to notifying Business Associate of any instances of which it is aware in 
which the confidentiality of the PHi has been breached; 

c) disclose PHI to report violations of law to appropriate federal and state 
authorities; or 

d) aggregate the PHI with other data in its possession for purposes of Covered 
Entity's Health Care Operations; 

e) make uses and disclosures and requests for protected health information 
consistent with Covered Entity's minimum necessary policies and procedures; 

f) de-identify any and all PHI obtained by Business Associate under this BAA, and 
use such de-identified data, all in accordance with the de-identification 
requirements of the Privacy Rule [45 C.F.R. § (d)(1)!. 

8, Obligations of Covered Entity: 
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a) Covered Entity shall notify Business Associate of any changes in, or revocation 
of, the permission by an individual to use or disclose his or her PHI, to the extent 
that such changes may affect Business Associate's use or disclosure of PHI. 

b) Covered Entity shall notify Business Associate of any restriction on the use or 
disclosure of PHI that Covered Entity has agreed to or is required to abide by 
under 45 C.F.R. 164.522, to the extent that such restriction may affect Business 
Associate's use or disclosure of protected health information. 

c) Covered Entity shall not request Business Associate use or disclose PHI in any 
manner that would violate the Privacy Rule if done by Covered Entity. 

d) DHS agrees to timely notify Business Associate, in writing, of any arrangements 
between DHS and the Individual that is the subject of PHI that may impact in 
any manner the use and/or disclosure of the PHI by Business Associate under 
this BAA. 


K. HIPAA 

1. Eckerd agrees to use and disclose Protected Health Information in compliance 
with the Standards for Privacy of Individually Identifiable Health Information 
(Privacy Rule) (45 C.F.R. Parts 160 and 164) under the Health Insurance Portability 
and Accountability Act (HIPAA) of 1996. The definitions set forth in the Privacy 

Rule are incorporated by reference into this Contract (45 C.F.R 160.103 and 
164.501). 

L. Governing Law, Venue, and Jurisdiction 

1. This MOU will be governed by and construed in accordance with the laws of the 
State of Oklahoma, excluding any conflicts of laws, rule, or principle that might 
refer the governance or construction of this MOU to the law of another 
Jurisdiction. The Parties agree that all disputes, claims, actions, or lawsuits 
between them, arising out of or relating to this MOU, or for alleged breach of this 
MOU, will be heard and determined by a state or federal court sitting in 
Oklahoma, or by any appellate courts which review decisions of those courts. 

M. Entire Agreement 

1. This MOU constitutes the entire agreement of the Parties with respect to the subject 
matter hereof, and supersedes any and all other agreements, understandings, 
negotiations, or representations between the Parties with respect thereto. 

N. Confidentiality 

1. Each Party agrees to maintain in confidence any information disclosed to it by, or 
discovered by it regarding, any other Party or Parties it knows or has reason to know 
is proprietary and/or confidential, including, without limitation, the terms of this 
MOU ("Confidential Information"). If the receiving Party becomes legally required 
to disclose Confidential information, or any part thereof, the receiving Party shall 
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give the disclosing Party prompt notice of such requirement. If the disclosing Party 
waives compliance with any of the terms of this Agreement or is unable to obtain a 
protective order or other appropriate remedy with respect to such disclosure of 
Confidential Information, then the receiving Party will disclose only that portion of 
the Confidential Information necessary to ensure compliance with such legal 
requirement. This Section 3.N. shall survive termination of this MOU. 


IN WITNESS WHEREOF, the Parties agree to the expressed terms. 
Eckerd OKDHS 


Bv: 

Name: Randall W. Luecke 
Title: Chief Financial Officer 



Name: ~ I jV M GON 
Title: 
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The first name In second chartces. SH 

Ecterd 


DATA SHARING AGREEMENT 

This Data Sharing Agreement ("Agreement"') is entered into by and between Oklahoma 
Department of Human Services, (the "Agency"), and Eckerd Youth Alternatives, Inc. d/b/a Eckerd, 
("Eckerd"). 

Whereas, the Agency will make available to Eckerd certain data that is confidential and must be 
afforded special treatment and protection; and, 

Whereas, Eckerd will receive and have access to data from the Agency that can be used or 
disclosed only In accordance with this agreement, the MOU dated April 1,2015, state and federal law; 

Now, therefore, the Agency and Eckerd agree as follows: 

!• Purpose of Agreement . Eckerd represents, and in furnishing the data specified in this 
agreement the Agency relies upon such representation, that the data specified in this 
agreement will be used solely for purposes of Eckerd Rapid Safety Feedback*”. 

2 - Description of Data. The Agency may disclose and Eckerd may obtain and use the following 
data ("Data") pursuant to this Agreement: 

a. All data contained in the Statewide Automated Child Welfare Information System 
("SACWIS"). 

Point of Contact. The Agency designates the following individual as the Agency's point of 
contact for this Agreement: 

Marvin Smith 
PO Box 25352 
Oklahoma City OK 73125 
405-522-3977 

All correspondence regarding this Agreement, including, but not limited to, notification of 
change of custodianship, uses or disclosures of the data not provided for by this agreement, 
requests for access to the Data, requests for accounting of disclosures of. the Data, disposition of 
the Data, and termination of this agreement, will be addressed to the point of contact. 

Custodial Responsibility. Eckerd names the following individual custodian of the Data on behalf 
of the Eckerd: 


1 



Ray Wright, Chief Information Officer 
Eckerd 

100 Starcrest Drive 
Clearwater, FL 33765 
727-461-2990 

The custodian will be responsible for the observance of all conditions of use and for the 
establishment and maintenance of safeguards as specified in this Agreement to prevent 
unauthorized use. 

5- Permissible Uses and Disclosures of Agency Data. Eckerd will not use or further disclose the 
Data specified in this Agreement except as permitted by this Agreement or as required by 
federal law. 

Eckerd will not release or allow the release of the Data specified in this Agreement to any 
persons or entities other than as permitted by Law or by this Agreement. 

Eckerd will restrict disclosure of the Data specified in this Agreement to the minimum number of 
individuals who require the information in order to perform the functions of this Agreement. 

The Agency specifically authorized Eckerd to share the Data with Mindshare Consulting Group 
LLC. 

Disclosure to Agents. Eckerd will ensure that any agents of Eckerd, including, but not limited 
to, a contractor or subcontractor, to whom Eckerd provides the Data specified in this Agreement 
agree to the same terms, conditions, and restrictions that apply to Eckerd with respect to the 
Data. 

7. Penalties. Eckerd acknowledges that failure to abide by the terms of this agreement may 
subject Eckerd to penalties for wrongful disclosure of protected health information under 
federal law. Eckerd will inform all persons with authorized access to the data specified in this 
agreement of the penalties for wrongful disclosure of protected health information. 

8- Disposition of Data . Eckerd may retain the Data specified in this Agreement until March 31, 
2016 (the "Retention Date"). Upon the Retention Date, Eckerd will destroy the Data and any 
information derived from its contents, including ail copies, modified data, or hybrid or merged 
databases containing the data. 

9- Term of Agreement . This Agreement will be effective upon execution by both parties and will 
remain in effect until March 31,2016. 

The terms of this agreement may not be waived, altered, modified, or amended except by written 
agreement of both parties. 
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IN WITNESS WHEREOF; the Agency and Eckerd have caused this agreement to be signed and delivered 
by their duly authorized representatives as of the date set forth below. 


Eckerd Agency 



Sd?-/s- 

Date 
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